Cyber999 Advisories

1.0 Introduction

Recently, Oracle has released its October 2026 Critical Patch Update. The update contains 1295 new security patches across many product families.

2.0 Impact

Successful exploitation of these vulnerabilities may allow an attacker to trigger remote code execution, denial of service, elevation of privilege, sensitive information disclosure, security restriction bypass and data manipulation on the targeted system. The Fusion Middleware patches alone include 131 vulnerabilities that can be exploited remotely without authentication, among them CVSS 10.0 flaws in Oracle Access Manager and Oracle SOA Suite. Other critical entries include CVE-2026-75803 in Oracle Database Server (CVSS 9.8) and CVE-2026-101521 in Oracle APEX (CVSS 9.8). This may lead to execution of arbitrary code, unauthorised access to sensitive information and system compromise.

3.0 Affected Products

• Oracle Database Server 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3
• Oracle E-Business Suite 12.2.3-12.2.15
• Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0, including WebLogic Server, SOA Suite, Access Manager and HTTP Server
• Oracle Java SE 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 26.0.2 and 27 
• MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49
• Oracle VM VirtualBox 7.2.16 and 7.2.20
• PeopleSoft Enterprise PeopleTools 8.61-8.63 and Siebel Applications 17.0-26.9
• Other Oracle products, including Oracle APEX, Essbase, REST Data Services, GoldenGate, Communications, Retail and Utilities applications

4.0 Recommendations

CyberSecurity Malaysia encourages users and administrators to review the following Oracle Critical Patch Update advisory and apply the necessary updates. Oracle states that patches are provided only for versions under Premier Support or Extended Support, so customers on older releases should upgrade to supported versions. Internet-facing systems, in particular Fusion Middleware, WebLogic, E-Business Suite and Java applications, should be prioritised.

Kindly refer to the following URL:

• https://www.oracle.com/security-alerts/cpuoct2026.html

Generally, we advise users to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact Cyber999 Incident Response Centre through the following channels:

E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my

5.0 References

• https://www.oracle.com/security-alerts/cpuoct2026.html
• https://blogs.oracle.com/security/october-2026-critical-patch-update-released